Extracted

• • Target

    39962cdef1efccb262b01e3bc41e4380ed1f925885f1a22178e505f5c440887a.exe

  • Size

    501KB

  • MD5

    6b34408cb796d4e16a6caa577ebce6b9

  • SHA1

    f011ab355ac5a00204c033f3ac73848f6ce4c0ee

  • SHA256

    39962cdef1efccb262b01e3bc41e4380ed1f925885f1a22178e505f5c440887a

  • SHA512

    344defa68966df547a0504ee221a2037f737d469e0c496009209f9334589f0f73ac69226bb74ea60eb116332ccaefa0d5c1f8972a5b9d34628d9bfcc4147ea84

  • SSDEEP

    12288:E2iNErX80k+laBnUISbE0u9QgYZoXONvIGc2:E1ij8v+MKjbE0ul+Nx

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2